By weakness (CWE)

CWE-121: related vulnerabilities

CVEs classified under CWE-121. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

153 published vulnerabilities · page 2 of 2

• CVE-2026-36813HIGH 7.5

  A buffer overflow vulnerability has been discovered in Tenda W15E router firmware version 15.11.0.10. The flaw exists in how the device processes image cropping requests and can be exploited by sending a specially crafted HTTP request to cause the router to crash or stop responding. No authentication is required to trigger the vulnerability, meaning attackers on the network can exploit it without credentials.

• CVE-2026-36819HIGH 7.5

  A buffer overflow vulnerability exists in Tenda W20E routers running firmware version 15.11.0.6. An attacker can send a specially crafted network request to trigger this flaw, causing the router to crash or become unresponsive. No authentication is required—the attack works over the network from the internet. The vulnerability does not allow attackers to steal data or take control of the device, but it can disrupt service availability.

• CVE-2026-36820HIGH 7.5

  A buffer overflow vulnerability exists in Tenda W20E routers running version 15.11.0.6. The flaw resides in how the device processes user input for web authentication whitelist settings. An attacker on the network can send a specially crafted request to crash the router's web service, causing it to become unavailable. No authentication is required to exploit this vulnerability.

• CVE-2026-36821HIGH 7.5

  Tenda W20E routers running firmware version 15.11.0.6 contain a buffer overflow flaw in the image cropping function. An unauthenticated attacker can send a specially crafted web request to crash the device, rendering it temporarily unavailable. No authentication is required, and the attack can be launched from the network without user interaction.

• CVE-2026-36822HIGH 7.5

  A buffer overflow vulnerability exists in Tenda W20E wireless routers running firmware version 15.11.0.6. The flaw is located in how the device processes the MAC address parameter when handling station deletion requests. An attacker on the network can send a specially crafted HTTP request to crash the router's web interface, temporarily disabling network connectivity for all connected devices. No user authentication is required, and the attack can be executed remotely over the network.

• CVE-2026-36823HIGH 7.5

  Tenda W20E routers running firmware version 15.11.0.6 contain a buffer overflow vulnerability in a web authentication function. An attacker can send a specially crafted HTTP request to crash the router, rendering it unavailable. The vulnerability requires no authentication and can be triggered remotely, making it a straightforward denial-of-service risk for affected deployments.

• CVE-2026-41565HIGH 7.5

  CryptX, a cryptographic library for Perl, contains a stack buffer overflow vulnerability in its AEAD (Authenticated Encryption with Associated Data) decryption functions. When these functions process an authentication tag longer than expected, they overflow a fixed-size buffer on the stack, potentially corrupting memory and crashing the application. An attacker who can supply a maliciously long authentication tag to vulnerable code paths can trigger this crash. The vulnerability affects four specific decryption functions: gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, and eax_decrypt_verify. Patches were released incrementally, with gcm_decrypt_verify fixed in version 0.088 and the remaining three functions addressed in version 0.088_001.

• CVE-2026-50031HIGH 7.5

  FreeIPMI is a widely-used open-source toolkit for managing servers through the IPMI interface—a standard hardware management protocol used across nearly all enterprise and data-center hardware. Two specific commands in FreeIPMI versions before 1.6.18 contain buffer overflow vulnerabilities that can be exploited by sending specially crafted responses from an IPMI server. If you run `ipmi-oem dell get-active-directory-config` or `ipmi-oem fujitsu get-sel-entry-long-text` against an attacker-controlled or compromised IPMI server, those overflows can crash your system or potentially allow arbitrary code execution on the machine running the FreeIPMI client.

• CVE-2026-51601HIGH 7.5

  Tenda CP3 V3.0 devices running firmware V31.1.9.91 contain a denial-of-service vulnerability in their RTSP (Real Time Streaming Protocol) service. An attacker who establishes a basic RTSP connection can send a specially crafted request with an abnormally long value in a specific field, causing the RTSP service to crash and become unavailable. The vulnerability requires the attacker to complete a standard RTSP handshake first, but no authentication credentials are needed.

• CVE-2026-51602HIGH 7.5

  Tenda CP3 V3.0 devices running firmware V31.1.9.91 contain a flaw in their RTSP (Real Time Streaming Protocol) service that allows an unauthenticated attacker on the network to crash the device by sending a specially crafted request. The vulnerability exploits a gap between two validation stages: the first stage checks basic request format, but the second stage fails to properly limit the size of URL data it processes. An attacker who sends a request containing exactly four repetitions of a valid RTSP URL can overflow a buffer in memory, immediately crashing the RTSP service and making the device unavailable to all users on that network.

• CVE-2026-51603HIGH 7.5

  Tenda CP3 V3.0 routers running firmware V31.1.9.91 contain a vulnerability in their RTSP media streaming service that allows anyone on the network to crash the device without needing to log in. An attacker must first establish a legitimate RTSP session, then send a specially crafted second request with an oversized URL field. The flaw lies in insufficient input validation—the second parsing stage fails to check URL length properly, letting a malformed request overflow a temporary buffer on the stack. When triggered, the RTSP service immediately crashes, knocking the router offline until manually restarted and preventing all users from streaming media or accessing the device remotely.

• CVE-2026-51604HIGH 7.5

  A stack-based buffer overflow in Tenda CP3 devices running firmware V31.1.9.91 can be triggered via a specially crafted RTSP PLAY request sent over the network. An attacker without credentials can crash the device, causing service disruption. The vulnerability affects the RTSP protocol handler and requires no user interaction to exploit.

• CVE-2026-51605HIGH 7.5

  A stack-based buffer overflow vulnerability exists in the RTSP (Real Time Streaming Protocol) service of Tenda CP3 devices running firmware V31.1.9.991. An unauthenticated attacker on the network can send a specially crafted TEARDOWN request to trigger the overflow, causing the service to crash and become unavailable. No authentication is required, and the attack can be executed remotely, making this a practical denial-of-service vector against affected devices.

• CVE-2026-52190HIGH 7.5

  A buffer overflow flaw in UTT's nv518G device (firmware version 3.2.7-210919-161313) can be exploited remotely to crash the device or cause it to become unresponsive. An attacker does not need to authenticate or interact with a user to trigger the vulnerability—simply sending a specially crafted network request to the gohead web service component is sufficient. While the current evidence suggests denial-of-service impact, buffer overflows carry inherent risk for more severe outcomes if exploitation techniques evolve.

• CVE-2026-55687HIGH 7.5

  A flaw in Espressif's IoT Development Framework (ESP-IDF) allows attackers to crash devices by sending specially crafted JPEG image data over the network. The vulnerability exists in the JPEG parser's handling of a specific image marker type (DQT, or Quantization Table). When processing these markers, the code fails to validate that a user-supplied index value stays within safe bounds, causing it to write data to unintended memory locations. This corrupts the device's stack and reliably triggers a denial of service, making the affected device unresponsive. No credentials or user interaction are required—an attacker on the network can trigger the crash remotely.

• CVE-2026-59692HIGH 7.5

  GStreamer's DTLS (Datagram Transport Layer Security) plugin contains a stack buffer overflow flaw that occurs during the SSL/TLS handshake process. When a remote attacker sends a specially crafted certificate with an unusually long subject name, the plugin crashes trying to store that name in a fixed 2048-byte buffer. The result is a denial-of-service condition—any application using GStreamer's DTLS functionality can be knocked offline by an unauthenticated attacker without needing credentials or user interaction.

• CVE-2026-12200HIGH 7.3

  TinyWeb Server version 1.94 and earlier on Windows contains a stack-based buffer overflow vulnerability in how it processes the Authorization header. An attacker can send a specially crafted HTTP request with a malicious Authorization header to overflow the server's memory and potentially execute code, crash the service, or access sensitive data. The vulnerability requires no authentication or user interaction to exploit, making it actionable for remote attackers.

• CVE-2026-30649HIGH 7.3

  A buffer overflow vulnerability exists in VIVOTEK's FD8136 network camera that allows an unauthenticated remote attacker to execute arbitrary code. The flaw is located in the set_getparam.cgi component, which handles parameter processing without proper boundary checks. An attacker on the network can send a specially crafted request to trigger the overflow and gain complete control of the device.

• CVE-2025-66280HIGH 7.2

  QNAP has patched an integer overflow vulnerability affecting their NAS operating systems. The flaw requires an attacker to first obtain administrator credentials, then exploit the memory handling weakness to gain elevated control or crash the system. While the barrier to entry is high—needing valid admin access—the potential impact is severe because it affects core system integrity. QNAP has released patched versions across QTS and QuTS hero product lines.

• CVE-2026-24085HIGH 7.2

  A memory corruption vulnerability exists in multiple Qualcomm wireless chipsets and their firmware when processing display command line information. The flaw stems from improper initialization of a variable during command parsing, which could allow a high-privilege attacker with physical access to trigger memory corruption and potentially execute arbitrary code or crash the device. The vulnerability affects a broad range of Qualcomm wireless components used in enterprise and consumer devices.

• CVE-2025-59613MEDIUM 6.7

  CVE-2025-59613 is a memory corruption vulnerability affecting Qualcomm wireless, compute, and AR/XR platforms. The flaw occurs when the system attempts to copy data into a buffer that is smaller than the source data being transferred, causing memory to be overwritten beyond the intended boundaries. An attacker with elevated privileges on the device could exploit this to corrupt memory and potentially compromise system integrity, confidentiality, or availability. The vulnerability requires local access and administrative-level permissions to trigger.

• CVE-2025-62858MEDIUM 6.5

  A buffer overflow flaw exists in QNAP's QTS and QuTS hero operating systems that allows a high-privileged attacker to corrupt memory or crash running processes. Because the vulnerability requires prior administrative access, the risk is contained to scenarios where an admin account has been compromised or a trusted insider acts maliciously. QNAP has released patched versions across all affected product lines.

• CVE-2026-1871MEDIUM 6.5

  TP-Link Tapo C200 v5 camera firmware contains a flaw in how it validates incoming RTSP (Real Time Streaming Protocol) authentication requests. An attacker on the local network can send a specially crafted authentication message that overflows a memory buffer, crashing the camera's streaming service and forcing an automatic reboot. During this outage, users cannot view live video or manage the camera remotely. Once the camera restarts, service is restored, but the vulnerability remains exploitable, making repeated attacks feasible.

• CVE-2026-36772MEDIUM 6.5

  Tenda W3 wireless routers running firmware version 1.0.0.3(2204) contain a stack overflow vulnerability in how they process the wl_radio parameter during SSID configuration requests. An attacker on the local network can send a specially crafted input to crash the router, causing a denial of service. The vulnerability requires no authentication and no user interaction to trigger.

• CVE-2026-36773MEDIUM 6.5

  A stack overflow vulnerability has been identified in Tenda W3 Wireless Router version 1.0.0.3(2204). The flaw exists in how the device processes the 'Go' parameter within its reboot function, allowing an attacker on the local network to send specially crafted input that causes the router to crash or become unresponsive. This is a denial-of-service issue—attackers cannot steal data or gain control, but they can disrupt network availability.

• CVE-2026-36777MEDIUM 6.5

  A stack overflow vulnerability exists in Tenda W3 wireless routers (version 1.0.0.3 Build 2204) that can be triggered via a specially crafted HTTP request. An attacker on the same network can send malicious input to crash the router, causing a temporary denial of service. The vulnerability does not compromise confidentiality or allow unauthorized access—it purely impacts availability.

• CVE-2026-36798MEDIUM 6.5

  A vulnerability exists in Tenda G0 router firmware version 15.11.0.5 where an attacker can crash the device by sending specially crafted HTTP requests that exploit multiple stack overflow conditions. The vulnerability requires user interaction—specifically, someone must click a malicious link or visit an attacker-controlled website—but does not require authentication. Once triggered, it causes a denial of service that prevents the router from functioning until it is rebooted.

• CVE-2026-43718MEDIUM 6.5

  Apple has patched a stack overflow vulnerability affecting Safari and multiple Apple operating systems. The flaw occurs when processing specially crafted web content and can cause Safari to crash unexpectedly. While the vulnerability requires user interaction (visiting a malicious website), it affects a widely-used browser on billions of devices. Apple addressed it through improved input validation in Safari 26.5.2 and corresponding OS updates across iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS.

• CVE-2026-60095MEDIUM 6.5

  Vinchin Backup & Recovery versions up to 9.0.0.86562 contain a vulnerability in the agentlink_server component that allows unauthenticated attackers to crash the service or potentially take control of it by sending a specially crafted network request. The vulnerability exists because the software copies user-supplied data into a fixed buffer without checking the length first, a classic memory safety flaw. An attacker on the network can exploit this without needing credentials.

• CVE-2026-9105MEDIUM 6.5

  A vulnerability in TP-Link TL-WR841N v14 routers allows anyone with valid login credentials to crash the device by sending specially crafted web requests. When triggered, the router's web server crashes and forces the device to automatically reboot, disrupting network connectivity until it comes back online. No data is at risk—this is purely a denial-of-service issue.

• CVE-2026-10064MEDIUM 6.3

  TRENDnet has disclosed a remote stack-based buffer overflow vulnerability in the TEW-432BRP wireless router (firmware version 3.10B20 and earlier). An authenticated attacker can exploit this flaw by sending a specially crafted request to the port forwarding configuration endpoint, potentially allowing code execution or denial of service. The vendor has confirmed this product reached end-of-life in 2009 and will not issue patches. Public exploit code is available, elevating the practical risk despite the device's age.

• CVE-2026-35716MEDIUM 6.3

  A stack-based buffer overflow vulnerability exists in VIVOTEK FD8136 IP cameras that allows an authenticated attacker to run arbitrary code with root privileges. The flaw is in the motion privacy configuration endpoint, which fails to validate the size of user input before copying it into a fixed-size buffer on the stack. Because the camera firmware lacks stack protection mechanisms, an attacker can overwrite return addresses and hijack program execution. An authenticated attacker on the network can exploit this remotely by sending a specially crafted POST request.

• CVE-2026-35717MEDIUM 6.3

  A stack-based buffer overflow exists in the export_language.cgi binary on VIVOTEK FD8136 IP cameras running firmware FD8136-VVTK-0300a. An authenticated attacker can send a specially crafted POST request to the language export endpoint with a malicious Content-Length value that causes the application to read more data than a 60-byte stack buffer can hold, overwriting critical return address information. This allows the attacker to execute arbitrary code with root privileges on the affected device. The vulnerability requires valid credentials to exploit but succeeds because the binary lacks stack protection mechanisms.

• CVE-2026-49943MEDIUM 6.3

  CZ.NIC BIRD Internet Routing Daemon versions up to 2.19.0 contain a stack-based buffer overflow vulnerability in its BGP AS_PATH filtering logic. When BIRD processes BGP UPDATE messages containing exceptionally long AS_PATH attributes—particularly when RFC 8654 Extended Messages are enabled—a mismatch between the fixed buffer size and the actual incoming data can cause the daemon to crash. An authenticated BGP peer can trigger this by sending a specially crafted UPDATE with an AS_PATH longer than what the code expects, leading to denial of service of the routing daemon.

• CVE-2026-12488MEDIUM 6.2

  GeoVision GV-VMS V20 version 20.0.2 contains a memory corruption flaw in its GV-Cloud component that can be exploited to cause service disruption. An attacker who can impersonate a legitimate server or send a specially crafted network request can trigger a denial-of-service condition. The vulnerability requires high privilege level and user interaction to exploit, limiting its attack surface but still warranting attention for environments relying on GV-Cloud functionality.

• CVE-2026-47318MEDIUM 6.1

  A stack-based buffer overflow has been found in Samsung's rlottie library, an open-source animation rendering engine. When processing untrusted animation files, the library can write data beyond its allocated memory on the stack, potentially causing the application to crash or allowing limited data manipulation. The vulnerability requires a user to open a malicious animation file; it cannot be exploited remotely.

• CVE-2026-58303MEDIUM 6.1

  A stack-based buffer overflow has been discovered in Samsung Open Source Escargot, a JavaScript engine. The vulnerability allows an attacker to write data beyond the bounds of allocated stack memory, potentially causing application crashes or enabling localized code execution. Because exploitation requires user interaction (such as opening a malicious file or visiting a compromised website), the risk is somewhat contained, though the impact can be significant depending on how Escargot is deployed.

• CVE-2026-31267MEDIUM 5.7

  Mercusys MW302R routers running firmware version 1.4.10 (build 231023) contain a buffer overflow flaw in the administrative web interface that allows authenticated administrators to crash the device. An attacker with admin credentials can send a specially crafted request that overwrites memory on the stack, causing the router to stop functioning. This is a denial-of-service issue—the attacker cannot steal data or gain higher privileges, but they can disrupt network operations by making the router unavailable.

• CVE-2025-55660MEDIUM 5.5

  CVE-2025-55660 is a stack overflow vulnerability in GPAC's MP4Box tool version 2.4. When a user opens a specially crafted MP4 video file, the vulnerability triggers a crash that renders the application temporarily unusable. An attacker would need to trick a user into opening a malicious MP4 file; the vulnerability does not allow remote code execution or data theft, but causes a denial of service. This is a localized threat affecting anyone using MP4Box to process untrusted video files.

• CVE-2025-7019MEDIUM 5.5

  A stack overflow flaw in antivirus scanning engines affects Avast, AVG, Norton, Avast One, and Avast Business products across Windows, macOS, and Linux. When these products scan a deliberately malformed Office Open XML file, the scanning process can crash, temporarily disabling antivirus protection on the affected machine. This is not a remote code execution or data theft risk, but it can leave systems unprotected during the outage. The vulnerability is fixed through a shared virus definition update; once your antivirus definitions reach build VPS 25020100 or later, you are protected.

• CVE-2026-15166MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains a flaw in its IEEE 802.11 wireless protocol parser that can cause the application to crash when processing specially crafted network packets. The vulnerability affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker who can trick a user into opening a malicious packet capture file or viewing live traffic on a compromised network could trigger a denial of service, forcing the analyst to restart their investigation. While the impact is localized to availability rather than exposing sensitive data, this disruption can interfere with incident response workflows and network troubleshooting.

• CVE-2026-36907MEDIUM 5.5

  A stack overflow vulnerability exists in Bento4, a multimedia framework used for MP4 file processing. The flaw resides in how the AP4_StsdAtom component handles crafted MP4 files, allowing an attacker to trigger a denial-of-service condition by causing the application to crash. The vulnerability requires local access and user interaction (opening a malicious file), but does not allow data theft or system modification—only service disruption.

• CVE-2026-36908MEDIUM 5.5

  Bento4, a popular MP4 multimedia library, contains a stack overflow flaw that crashes applications when processing specially crafted MP4 files. An attacker can trigger this denial-of-service condition by tricking a user into opening a malicious video file. The vulnerability affects Bento4 versions before 1.8.9 and is moderately severe because it requires user interaction but can reliably disable affected services.

• CVE-2026-49760MEDIUM 5.5

  A stack-based buffer overflow exists in Erlang OTP's erl_interface library, specifically in the ei_s_print_term function. When this function processes Erlang terms with extremely large integer representations—those exceeding 2000 characters when encoded—it writes beyond the bounds of its internal 2000-byte stack buffer. The overflow is constrained to hexadecimal and decimal characters (0-9, A-F), which significantly limits the practical attack surface to denial of service rather than arbitrary code execution. The related ei_print_term function, which outputs to files instead of memory buffers, does not suffer from this flaw.

• CVE-2026-11793MEDIUM 4.9

  A stack buffer overflow vulnerability has been identified in 389 Directory Server's password handling code. When parsing specially crafted credentials, the checkPrefix() function in pw.c fails to validate the length of an algorithm identifier before copying it into a fixed 256-byte buffer. An attacker with Directory Manager credentials can exploit this to crash the LDAP server. While the vulnerability could theoretically allow code execution, compiler protections like FORTIFY_SOURCE limit the practical impact to denial of service in most deployments.

• CVE-2026-36778MEDIUM 4.9

  A stack overflow vulnerability has been identified in Tenda O3 Wireless Router version 1.0.0.5(4180). The flaw exists in how the router processes the username parameter when handling certain web requests. An attacker with elevated privileges on the network can send a specially crafted HTTP request that causes the router to crash, resulting in a denial of service. The router would need to be rebooted to restore functionality. This is a medium-severity issue that requires administrative-level access to exploit, limiting its immediate threat in most environments.

• CVE-2026-0413MEDIUM 4.5

  A buffer overflow flaw in NETGEAR Orbi mesh router firmware allows authenticated administrators on the local network to modify router software and functionality without authorization. The vulnerability stems from insufficient input validation, meaning an admin account could inject malicious data that overwrites system memory. While exploitation requires valid administrative credentials and local network access, the ability to alter router firmware represents a serious integrity compromise.

• CVE-2026-40510LOW 3.8

  OpenSC, a widely-used open-source smart card library, contains a stack buffer overflow flaw in how it processes the Key History Object from PIV (Personal Identity Verification) cards. An attacker with physical access to a system could craft a malicious smart card or USB device that returns an oversized URL field—exceeding 118 bytes—triggering memory corruption. This vulnerability requires the attacker to be physically present at the machine and involves user interaction, limiting its reach but posing a real concern in environments where untrusted hardware may be connected.

• CVE-2026-40528LOW 3.8

  OpenSC, a widely-used open-source library for working with smart cards and cryptographic tokens, contains a buffer overflow vulnerability in its profile configuration parser. When OpenSC's pkcs15-init tool processes a maliciously crafted configuration file, it can be tricked into copying more data than a buffer can hold, corrupting memory. An attacker would need local access to supply the malicious file and convince a user to run the initialization tool, but successful exploitation could allow memory corruption and potential code execution.

• CVE-2026-10528LOW 3.3

  Orthanc DICOM Server versions up to 1.12.11 contain a stack-based buffer overflow vulnerability in the DCMTK parser component. The flaw exists in the DcmItem::read function and can be triggered through malicious DICOM file manipulation. An attacker with local system access can exploit this to cause a denial of service condition. The vulnerability has been publicly disclosed with working exploit code available.

• CVE-2026-13573LOW 3.3

  A stack-based buffer overflow vulnerability has been reported in LLVM's StringMap insertion function within the ValueSymbolTable module. The issue affects LLVM versions up to 22.1.6 and requires local access to exploit. Notably, the LLVM project has stated this behavior falls outside their documented security scope and is not considered a security vulnerability by the maintainers. Exploit code has been publicly disclosed, though verification of the vulnerability's actual exploitability remains uncertain.

• CVE-2026-14789LOW 3.3

  A stack-based buffer overflow vulnerability exists in radare2's Memory64ListStream Parser component, which processes memory dump files. An attacker with local access can manipulate a specially crafted input file to trigger a buffer overflow, potentially causing the application to crash. This is a localized denial-of-service issue affecting radare2 versions up to 6.1.6.

• CVE-2026-41434LOW 3.3

  OP-TEE, a security-focused runtime environment for Arm processors, contains a flaw in its PKCS#11 trusted application that can be triggered by a local attacker with basic privileges. When exploited, the vulnerability causes the PKCS#11 component to enter an infinite recursive loop, crashing that trusted application. The issue affects versions 3.10.0 through 4.10.x; version 4.11.0 and later include the fix.